weichen
ffa41d78df
Unseal SEMANTIC_SUMMARY_REPLACE under explicit user authorization with a defense-in-depth session allowlist (SEMANTIC_SUMMARY_REPLACE_SESSIONS): swap happens only for allowlisted sessions after result digests and served watermark validation, bounded narrative size; facts/counts stay deterministic and the daily digest stays advisory. Master flag alone replaces nothing.
108 lines
3.3 KiB
Go
108 lines
3.3 KiB
Go
package ctxmgr
|
|
|
|
import (
|
|
"os"
|
|
"strings"
|
|
"sync"
|
|
)
|
|
|
|
const (
|
|
EnvSemanticSummaryShadow = "SEMANTIC_SUMMARY_SHADOW"
|
|
// REPLACE was sealed by Wave 5 X-2 (2026-09-18). Unsealed 2026-09-26 under an
|
|
// explicit user authorization for the chat-semantic-replace closeout task:
|
|
// wiring is fail-closed and gray-released via a session allowlist. Enabling
|
|
// the master flag alone replaces nothing while the allowlist is empty.
|
|
// See .doc/ops/short-term/2026-09-26-chat-semantic-replace.md and
|
|
// .doc/ops/short-term/2026-09-18-wave5-deadcode-decisions.md#x-2 (history).
|
|
EnvSemanticSummaryReplace = "SEMANTIC_SUMMARY_REPLACE"
|
|
// EnvSemanticSummaryReplaceSessions is the fail-closed gray-release
|
|
// allowlist: comma-separated chat session IDs eligible for narrative
|
|
// replacement. Empty allowlist (default) replaces no session.
|
|
EnvSemanticSummaryReplaceSessions = "SEMANTIC_SUMMARY_REPLACE_SESSIONS"
|
|
)
|
|
|
|
// SummaryFeatureFlags controls semantic summary rollout. REPLACE swaps the
|
|
// served chat Narrative only for allowlisted sessions (fail-closed gray).
|
|
type SummaryFeatureFlags struct {
|
|
Shadow bool
|
|
Replace bool
|
|
ReplaceSessions map[string]struct{}
|
|
}
|
|
|
|
var (
|
|
summaryFlagsMu sync.RWMutex
|
|
activeSummaryFlags = loadSummaryFlagsFromEnv()
|
|
)
|
|
|
|
func loadSummaryFlagsFromEnv() SummaryFeatureFlags {
|
|
return SummaryFeatureFlags{
|
|
Shadow: envBoolDefault(EnvSemanticSummaryShadow, false),
|
|
Replace: envBoolDefault(EnvSemanticSummaryReplace, false),
|
|
ReplaceSessions: parseReplaceSessions(os.Getenv(EnvSemanticSummaryReplaceSessions)),
|
|
}
|
|
}
|
|
|
|
func parseReplaceSessions(raw string) map[string]struct{} {
|
|
out := make(map[string]struct{})
|
|
for _, part := range strings.Split(raw, ",") {
|
|
id := strings.TrimSpace(part)
|
|
if id != "" {
|
|
out[id] = struct{}{}
|
|
}
|
|
}
|
|
return out
|
|
}
|
|
|
|
func envBoolDefault(key string, def bool) bool {
|
|
v := strings.TrimSpace(os.Getenv(key))
|
|
if v == "" {
|
|
return def
|
|
}
|
|
return v == "1" || strings.EqualFold(v, "true") || strings.EqualFold(v, "yes")
|
|
}
|
|
|
|
// CurrentSummaryFlags returns the active summary feature flags.
|
|
func CurrentSummaryFlags() SummaryFeatureFlags {
|
|
summaryFlagsMu.RLock()
|
|
defer summaryFlagsMu.RUnlock()
|
|
return activeSummaryFlags
|
|
}
|
|
|
|
// SemanticSummaryShadowEnabled reports whether shadow semantic summary is on.
|
|
func SemanticSummaryShadowEnabled() bool {
|
|
return CurrentSummaryFlags().Shadow
|
|
}
|
|
|
|
// SemanticSummaryReplaceEnabled reports the REPLACE master env bit.
|
|
// Narrative replacement additionally requires the session allowlist
|
|
// (SemanticReplaceEnabledFor); the master bit alone replaces nothing.
|
|
func SemanticSummaryReplaceEnabled() bool {
|
|
return CurrentSummaryFlags().Replace
|
|
}
|
|
|
|
// SemanticReplaceEnabledFor reports fail-closed gray eligibility: the master
|
|
// flag must be on AND the session must be in the allowlist (empty allowlist
|
|
// replaces no session).
|
|
func SemanticReplaceEnabledFor(sessionID string) bool {
|
|
f := CurrentSummaryFlags()
|
|
if !f.Replace || sessionID == "" {
|
|
return false
|
|
}
|
|
_, ok := f.ReplaceSessions[sessionID]
|
|
return ok
|
|
}
|
|
|
|
// SetSummaryFlagsForTest overrides flags in tests.
|
|
func SetSummaryFlagsForTest(f SummaryFeatureFlags) {
|
|
summaryFlagsMu.Lock()
|
|
activeSummaryFlags = f
|
|
summaryFlagsMu.Unlock()
|
|
}
|
|
|
|
// ResetSummaryFlagsForTest restores flags from the process environment.
|
|
func ResetSummaryFlagsForTest() {
|
|
summaryFlagsMu.Lock()
|
|
activeSummaryFlags = loadSummaryFlagsFromEnv()
|
|
summaryFlagsMu.Unlock()
|
|
}
|